mssql 12.7.1 → 12.7.3

package/README.md

@@ -155,6 +155,13 @@ const config = {
 * [bulk](#bulk-table-options-callback)
 * [cancel](#cancel)
 
+### Identifier rules
+
+* [Parameter names](#parameter-names)
+* [Column names](#column-names)
+* [Type names and sizes](#type-names-and-sizes)
+* [Procedure names](#procedure-names)
+
 ### Transactions
 
 * [Transaction](#transaction)
@@ -913,6 +920,7 @@ request.execute('procedure_name', (err, result) => {
 
 __Errors__
 - EREQUEST (`RequestError`) - *Message from SQL Server*
+- EINJECT (`RequestError`) - Procedure name or parameter type is not a valid identifier. See [Identifiers](#identifiers).
 - ECANCEL (`RequestError`) - Cancelled.
 - ETIMEOUT (`RequestError`) - Request timeout.
 - ENOCONN (`RequestError`) - No connection is specified for that request.
@@ -972,7 +980,7 @@ sql.map.register(Number, sql.BigInt)
 
 __Errors__ (synchronous)
 - EARGS (`RequestError`) - Invalid number of arguments.
-- EINJECT (`RequestError`) - SQL injection warning.
+- EINJECT (`RequestError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -997,7 +1005,7 @@ request.output('output_parameter', sql.VarChar(50), 'abc')
 
 __Errors__ (synchronous)
 - EARGS (`RequestError`) - Invalid number of arguments.
-- EINJECT (`RequestError`) - SQL injection warning.
+- EINJECT (`RequestError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1121,6 +1129,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 ```javascript
 const request = new sql.Request()
@@ -1166,6 +1175,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1210,6 +1220,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Column name or parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1444,7 +1455,7 @@ ps.input('input_parameter', sql.VarChar(50))
 
 __Errors__ (synchronous)
 - EARGS (`PreparedStatementError`) - Invalid number of arguments.
-- EINJECT (`PreparedStatementError`) - SQL injection warning.
+- EINJECT (`PreparedStatementError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1466,7 +1477,7 @@ ps.output('output_parameter', sql.VarChar(50))
 
 __Errors__ (synchronous)
 - EARGS (`PreparedStatementError`) - Invalid number of arguments.
-- EINJECT (`PreparedStatementError`) - SQL injection warning.
+- EINJECT (`PreparedStatementError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -2039,6 +2050,100 @@ Results in:
 ]
 ```
 
+## Identifiers
+
+Values are sent to the server as parameters and may hold anything. A few things
+are not values, and cannot be: the name of a parameter, the name of a column in a
+bulk load, the type a parameter is declared as, and the name of a stored procedure.
+Those are *identifiers*, and
+no SQL database can bind them, so this library builds them into the statement it
+sends. It checks them, and rejects anything that could end the identifier and have
+the rest of the value read as SQL.
+
+That check is not a substitute for your own. If any of these comes from somewhere
+you do not control, map it to a value you expect first:
+
+```javascript
+const columns = { name: 'name', created: 'created_at' }        // what you allow
+const column = columns[req.query.sortBy]                       // what they asked for
+if (!column) throw new Error('unknown column')
+
+request.input(column, sql.NVarChar, value)
+```
+
+### Parameter names
+
+`request.input()`, `request.output()` and the same methods on a prepared statement
+take a name without the leading `@`. It may hold letters, digits, marks and
+connector punctuation from any script, along with `@`, `#`, `$` and the two
+zero-width joiners. A name that is not a string or a number is rejected, as is one
+holding an invisible format character, because one of them is a separator the
+server treats as ending the identifier.
+
+Anything else raises `EINJECT`. Note that a name this library accepts may still be
+one the server rejects; the check is deliberately wider than the server's own rules
+so that it only refuses what could change the shape of the statement.
+
+### Column names
+
+`table.columns.add()` names a column in a bulk load, and the name is emitted as a
+quoted identifier. A `]` ends that quoting, so a name holding one must double it,
+which is how T-SQL escapes it:
+
+```javascript
+table.columns.add('a]]b', sql.Int)   // the column named a]b
+```
+
+A single `]` raises `EINJECT`. Column names are not otherwise restricted: spaces,
+punctuation and reserved words are all fine, because the quoting handles them.
+
+The keys of `options.order` are also identifiers, but the driver writes them into the bulk
+statement's `ORDER (...)` clause *unquoted* rather than as `[name]`. They follow the type
+name rule instead: bare, or quoted with brackets or double quotes.
+
+```javascript
+request.bulk(table, { order: { created_at: 'ASC' } })
+request.bulk(table, { order: { '[Created At]': 'DESC' } })   // quote a spaced name yourself
+```
+
+### Type names and sizes
+
+`sql.TVP()` takes the name of a table type, optionally qualified with a schema and
+optionally quoted with brackets or double quotes. A size — the length, precision or
+scale of a type such as `sql.VarChar()` — must be a number, or the word `max` the
+declaration accepts in its place. Padding is trimmed.
+
+```javascript
+request.input('rows', sql.TVP('dbo.[My Type]'), table)
+request.input('name', sql.VarChar(50), value)
+request.input('note', sql.VarChar('max'), value)
+```
+
+A size is checked wherever it is built into SQL, which includes the declaration a
+bulk load sends and the parameter list a query sends, not only `sql.TVP()`.
+
+### Procedure names
+
+`request.execute()` takes the name of a stored procedure, optionally qualified with
+a server, database and schema and optionally quoted with brackets or double quotes.
+An omitted part may be left empty, as T-SQL allows. The `msnodesqlv8` driver builds
+this into the statement it sends; the `tedious` driver sends it as a bound remote
+procedure call and could not be injected through it. Both check it, so a name is
+accepted or rejected the same way whichever driver you use.
+
+```javascript
+request.execute('dbo.[My Procedure]')
+request.execute('master..sp_who')      // an omitted schema is fine
+```
+
+The first and last parts must be present, so `.proc` and `db..` are rejected.
+
+Anything else raises `EINJECT`. Numbered procedures — the deprecated
+`procedure;1` form — are rejected, because the `;` cannot be told apart from the
+end of a statement.
+
+---------------------------------------
+
 ## Errors
 
 There are 4 types of errors you can handle:
@@ -2075,10 +2180,10 @@ Name | Code | Message
 `RequestError` | ECANCEL | Cancelled.
 `RequestError` | ETIMEOUT | Request timeout.
 `RequestError` | EARGS | Invalid number of arguments.
-`RequestError` | EINJECT | SQL injection warning.
+`RequestError` | EINJECT | Parameter name, column name or type is not a valid identifier.
 `RequestError` | ENOCONN | No connection is specified for that request.
 `PreparedStatementError` | EARGS | Invalid number of arguments.
-`PreparedStatementError` | EINJECT | SQL injection warning.
+`PreparedStatementError` | EINJECT | Parameter name is not a valid identifier.
 `PreparedStatementError` | EALREADYPREPARED | Statement is already prepared.
 `PreparedStatementError` | ENOTPREPARED | Statement is not prepared.
 

package/lib/base/prepared-statement.js

@@ -2,7 +2,7 @@
 
 const debug = require('debug')('mssql:base')
 const { EventEmitter } = require('node:events')
-const { IDS, objectHasProperty, getPoolId } = require('../utils')
+const { IDS, objectHasProperty, getPoolId, isValidParameterName } = require('../utils')
 const globalConnection = require('../global-connection')
 const { TransactionError, PreparedStatementError } = require('../error')
 const shared = require('../shared')
@@ -97,8 +97,8 @@ class PreparedStatement extends EventEmitter {
    */
 
   input (name, type) {
-    if (/--| |\/\*|\*\/|'/.test(name)) {
-      throw new PreparedStatementError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new PreparedStatementError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -150,8 +150,8 @@ class PreparedStatement extends EventEmitter {
    */
 
   output (name, type) {
-    if (/--| |\/\*|\*\/|'/.test(name)) {
-      throw new PreparedStatementError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new PreparedStatementError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -254,17 +254,25 @@ class PreparedStatement extends EventEmitter {
       req._internal = true
       req.stream = false
       req.output('handle', TYPES.Int)
-      req.input('params', TYPES.NVarChar, ((() => {
-        const result = []
+      let params
+      try {
+        params = []
         for (const name in this.parameters) {
           if (!objectHasProperty(this.parameters, name)) {
             continue
           }
           const param = this.parameters[name]
-          result.push(`@${name} ${declare(param.type, param)}${param.io === 2 ? ' output' : ''}`)
+          // a connection is held here, so a rejected declaration has to be reported
+          // through the path that releases it
+          params.push(`@${name} ${declare(param.type, param)}${param.io === 2 ? ' output' : ''}`)
         }
-        return result
-      })()).join(','))
+      } catch (e) {
+        this.parent.release(this._acquiredConnection)
+        this._acquiredConnection = null
+        this._acquiredConfig = null
+        return callback(new PreparedStatementError(e, 'EREQUEST'))
+      }
+      req.input('params', TYPES.NVarChar, params.join(','))
       req.input('stmt', TYPES.NVarChar, this.statement)
       req.execute('sp_prepare', (err, result) => {
         if (err) {

package/lib/base/request.js

@@ -3,7 +3,7 @@
 const debug = require('debug')('mssql:base')
 const { EventEmitter } = require('node:events')
 const { Readable } = require('node:stream')
-const { IDS, objectHasProperty, getPoolId } = require('../utils')
+const { IDS, objectHasProperty, getPoolId, isValidParameterName } = require('../utils')
 const globalConnection = require('../global-connection')
 const { RequestError, ConnectionError } = require('../error')
 const { TYPES } = require('../datatypes')
@@ -115,8 +115,8 @@ class Request extends EventEmitter {
    */
 
   input (name, type, value) {
-    if (/--| |\/\*|\*\/|'/.test(name)) {
-      throw new RequestError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new RequestError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -178,8 +178,8 @@ class Request extends EventEmitter {
   output (name, type, value) {
     if (!type) { type = TYPES.NVarChar }
 
-    if (/--| |\/\*|\*\/|'/.test(name)) {
-      throw new RequestError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new RequestError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if ((type === TYPES.Text) || (type === TYPES.NText) || (type === TYPES.Image)) {

package/lib/datatypes.js

@@ -1,6 +1,5 @@
 'use strict'
-
-const objectHasProperty = require('./utils').objectHasProperty
+const { objectHasProperty, assertSafeTypeName, assertSafeTypeSize } = require('./utils')
 const inspect = Symbol.for('nodejs.util.inspect.custom')
 
 const TYPES = {
@@ -133,19 +132,33 @@ for (const key in TYPES) {
 }
 
 module.exports.declare = (type, options) => {
+  // sizes and the type name reach the generated declaration directly, so they are checked
+  // here rather than trusted from whatever built the parameter. Each is read only in the
+  // branch that emits it, so a type that takes no size still needs no options.
   switch (type) {
-    case TYPES.VarChar: case TYPES.VarBinary:
-      return `${type.declaration} (${options.length > 8000 ? 'MAX' : (options.length == null ? 'MAX' : options.length)})`
-    case TYPES.NVarChar:
-      return `${type.declaration} (${options.length > 4000 ? 'MAX' : (options.length == null ? 'MAX' : options.length)})`
-    case TYPES.Char: case TYPES.NChar: case TYPES.Binary:
-      return `${type.declaration} (${options.length == null ? 1 : options.length})`
-    case TYPES.Decimal: case TYPES.Numeric:
-      return `${type.declaration} (${options.precision == null ? 18 : options.precision}, ${options.scale == null ? 0 : options.scale})`
-    case TYPES.Time: case TYPES.DateTime2: case TYPES.DateTimeOffset:
-      return `${type.declaration} (${options.scale == null ? 7 : options.scale})`
+    case TYPES.VarChar: case TYPES.VarBinary: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length > 8000 ? 'MAX' : (length == null ? 'MAX' : length)})`
+    }
+    case TYPES.NVarChar: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length > 4000 ? 'MAX' : (length == null ? 'MAX' : length)})`
+    }
+    case TYPES.Char: case TYPES.NChar: case TYPES.Binary: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length == null ? 1 : length})`
+    }
+    case TYPES.Decimal: case TYPES.Numeric: {
+      const precision = assertSafeTypeSize(options.precision)
+      const scale = assertSafeTypeSize(options.scale)
+      return `${type.declaration} (${precision == null ? 18 : precision}, ${scale == null ? 0 : scale})`
+    }
+    case TYPES.Time: case TYPES.DateTime2: case TYPES.DateTimeOffset: {
+      const scale = assertSafeTypeSize(options.scale)
+      return `${type.declaration} (${scale == null ? 7 : scale})`
+    }
     case TYPES.TVP:
-      return `${options.tvpType} readonly`
+      return `${assertSafeTypeName(options.tvpType)} readonly`
     default:
       return type.declaration
   }

package/lib/msnodesqlv8/request.js

@@ -4,7 +4,7 @@ const msnodesql = require('msnodesqlv8')
 const debug = require('debug')('mssql:msv8')
 const BaseRequest = require('../base/request')
 const RequestError = require('../error/request-error')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, assertSafeColumnName, assertSafeTypeName, assertSafeTypeSize, assertSafeProcedureName } = require('../utils')
 const { TYPES, DECLARATIONS, declare } = require('../datatypes')
 const { PARSERS: UDT } = require('../udt')
 const Table = require('../table')
@@ -160,16 +160,32 @@ class Request extends BaseRequest {
 
       try {
         table._makeBulk()
+        // Checked before a connection is borrowed, so that a rejected name cannot leave
+        // the pool short of one.
+        table.columns.forEach(col => {
+          assertSafeColumnName(col.name)
+          // This driver hands the column definition to its table manager rather than writing
+          // it into SQL, so a size never reaches a statement here. It is checked all the same,
+          // so that a column either works on both drivers or on neither.
+          assertSafeTypeSize(col.length)
+          assertSafeTypeSize(col.precision)
+          assertSafeTypeSize(col.scale)
+        })
+        // checked here too, so an ordering key is accepted or rejected the same way on
+        // either driver even though this one does not build the statement itself
+        if (options && options.order) {
+          Object.keys(options.order).forEach(key => assertSafeTypeName(key))
+        }
       } catch (e) {
         return callback(new RequestError(e, 'EREQUEST'))
       }
 
       if (!table.name) {
-        setImmediate(callback, new RequestError('Table name must be specified for bulk insert.', 'ENAME'))
+        return setImmediate(callback, new RequestError('Table name must be specified for bulk insert.', 'ENAME'))
       }
 
       if (table.name.charAt(0) === '@') {
-        setImmediate(callback, new RequestError("You can't use table variables for bulk insert.", 'ENAME'))
+        return setImmediate(callback, new RequestError("You can't use table variables for bulk insert.", 'ENAME'))
       }
 
       this.parent.acquire(this, (err, connection, config) => {
@@ -201,8 +217,11 @@ class Request extends BaseRequest {
                 connection.hasError = true
               }
 
+              // a rejected identifier keeps its own code; anything else is a driver
+              // error, whose numeric code must not become the public one
+              const rejectedIdentifier = err.code === 'EINJECT'
               err = new RequestError(err)
-              err.code = 'EREQUEST'
+              err.code = rejectedIdentifier ? 'EINJECT' : 'EREQUEST'
             }
 
             this.parent.release(connection)
@@ -222,14 +241,29 @@ class Request extends BaseRequest {
               }
 
               const rows = []
-              for (const row of Array.from(table.rows)) {
-                const item = {}
-                for (let index = 0; index < table.columns.length; index++) {
-                  const col = table.columns[index]
-                  item[col.name] = row[index]
+              try {
+                for (const col of table.columns) {
+                  // re-checked here for the same reason as the name below, in case the
+                  // definition changed since it was checked above
+                  assertSafeTypeSize(col.length)
+                  assertSafeTypeSize(col.precision)
+                  assertSafeTypeSize(col.scale)
                 }
 
-                rows.push(item)
+                for (const row of Array.from(table.rows)) {
+                  const item = {}
+                  for (let index = 0; index < table.columns.length; index++) {
+                    const col = table.columns[index]
+                    // this driver hands the name to its table manager rather than writing
+                    // it into SQL, but it is checked here all the same: a name either
+                    // works on both drivers or on neither
+                    item[assertSafeColumnName(col.name)] = row[index]
+                  }
+
+                  rows.push(item)
+                }
+              } catch (e) {
+                return done(e)
               }
 
               mgr.insertRows(rows, done)
@@ -244,10 +278,19 @@ class Request extends BaseRequest {
               objectid = table.path
             }
 
-            return connection.queryRaw({
-              query_str: `if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`,
-              query_timeout: (this.overrides.requestTimeout ?? config.requestTimeout) / 1000 // msnodesqlv8 timeouts are in seconds (<1 second not supported)
-            }, function (err) {
+            // A connection is held from here on, so a column name that changed since it
+            // was checked above must be reported through `done`, which releases it.
+            let statement
+            try {
+              statement = {
+                query_str: `if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`,
+                query_timeout: (this.overrides.requestTimeout ?? config.requestTimeout) / 1000 // msnodesqlv8 timeouts are in seconds (<1 second not supported)
+              }
+            } catch (e) {
+              return done(e)
+            }
+
+            return connection.queryRaw(statement, function (err) {
               if (err) { return done(err) }
               go()
             })
@@ -259,7 +302,7 @@ class Request extends BaseRequest {
     })
   }
 
-  _query (command, callback) {
+  _query (command, callback, bound) {
     super._query(command, err => {
       if (err) return callback(err)
 
@@ -329,12 +372,18 @@ class Request extends BaseRequest {
 
       if (!this._nested) {
         const input = []
-        for (const name in this.parameters) {
-          if (!objectHasProperty(this.parameters, name)) {
-            continue
+        try {
+          for (const name in this.parameters) {
+            if (!objectHasProperty(this.parameters, name)) {
+              continue
+            }
+            const param = this.parameters[name]
+            // this callback is dispatched on its own tick, so a rejected declaration has
+            // to be handed back rather than thrown
+            input.push(`@${param.name} ${declare(param.type, param)}`)
           }
-          const param = this.parameters[name]
-          input.push(`@${param.name} ${declare(param.type, param)}`)
+        } catch (e) {
+          return callback(new RequestError(e, 'EREQUEST'))
         }
 
         const sets = []
@@ -343,7 +392,9 @@ class Request extends BaseRequest {
             continue
           }
           const param = this.parameters[name]
-          if (param.io === 1) {
+          // an output's initial value is bound with the inputs below, so it needs a marker too;
+          // an output given no value is null, and 0, '' and false are values like any other
+          if (param.io === 1 || (param.io === 2 && param.value != null)) {
             sets.push(`set @${param.name}=?`)
           }
         }
@@ -377,15 +428,23 @@ class Request extends BaseRequest {
           return callback(new RequestError('Canceled.', 'ECANCEL'))
         }
 
+        // values are bound to the markers by position, so a caller that writes its own
+        // markers passes the parameters in the order it wrote them
         const params = []
-        for (const name in this.parameters) {
-          if (!objectHasProperty(this.parameters, name)) {
-            continue
-          }
-          const param = this.parameters[name]
-          if (param.io === 1 || (param.io === 2 && param.value)) {
+        if (bound) {
+          for (const param of bound) {
             params.push(castParameter(param.value, param.type))
           }
+        } else {
+          for (const name in this.parameters) {
+            if (!objectHasProperty(this.parameters, name)) {
+              continue
+            }
+            const param = this.parameters[name]
+            if (param.io === 1 || (param.io === 2 && param.value != null)) {
+              params.push(castParameter(param.value, param.type))
+            }
+          }
         }
 
         debug('request(%d): query', IDS.get(this), command)
@@ -649,16 +708,38 @@ class Request extends BaseRequest {
       if (err) return callback(err)
 
       const params = []
-      for (const name in this.parameters) {
-        if (!objectHasProperty(this.parameters, name)) {
-          continue
-        }
-        const param = this.parameters[name]
-        if (param.io === 2) {
-          params.push(`@${param.name} ${declare(param.type, param)}`)
+      let procedureName
+      try {
+        // this is built into `exec @___return___ = <name>` below and run as SQL text, so it is
+        // checked before it is emitted
+        procedureName = assertSafeProcedureName(procedure)
+        for (const name in this.parameters) {
+          if (!objectHasProperty(this.parameters, name)) {
+            continue
+          }
+          const param = this.parameters[name]
+          if (param.io === 2) {
+            // this callback is dispatched on its own tick, so a rejected declaration has
+            // to be handed back rather than thrown
+            params.push(`@${param.name} ${declare(param.type, param)}`)
+          } else {
+            // An input parameter is bound rather than written into the command, so only an
+            // output parameter's size is declared here and nothing would otherwise check an
+            // input's. It is checked so that a size is accepted or rejected the same way
+            // whichever driver is in use.
+            assertSafeTypeSize(param.length)
+            assertSafeTypeSize(param.precision)
+            assertSafeTypeSize(param.scale)
+          }
         }
+      } catch (e) {
+        return callback(new RequestError(e, 'EREQUEST'))
       }
 
+      // the parameters in the order their markers are written: output initial values are set
+      // before the call and inputs are passed to it, whatever order they were declared in
+      const bound = []
+
       // set output params w/ values
       const sets = []
       for (const name in this.parameters) {
@@ -666,13 +747,14 @@ class Request extends BaseRequest {
           continue
         }
         const param = this.parameters[name]
-        if (param.io === 2 && param.value) {
+        if (param.io === 2 && param.value != null) {
           sets.push(`set @${param.name}=?`)
+          bound.push(param)
         }
       }
 
       let cmd = `declare ${['@___return___ int'].concat(params).join(', ')};${sets.join(';')};`
-      cmd += `exec @___return___ = ${procedure} `
+      cmd += `exec @___return___ = ${procedureName} `
 
       const spp = []
       for (const name in this.parameters) {
@@ -687,6 +769,7 @@ class Request extends BaseRequest {
         } else {
           // input parameter
           spp.push(`@${param.name}=?`)
+          bound.push(param)
         }
       }
 
@@ -762,7 +845,7 @@ class Request extends BaseRequest {
         } else {
           callback(null, recordsets, output, returnValue, rowsAffected, recordsetcolumns)
         }
-      })
+      }, bound)
     })
   }
 

package/lib/table.js

@@ -2,7 +2,7 @@
 
 const TYPES = require('./datatypes').TYPES
 const declareType = require('./datatypes').declare
-const objectHasProperty = require('./utils').objectHasProperty
+const { objectHasProperty, assertSafeColumnName } = require('./utils')
 
 const MAX = 65535 // (1 << 16) - 1
 const JSON_COLUMN_ID = 'JSON_F52E2B61-18A1-11d1-B105-00805F49916B'
@@ -99,9 +99,9 @@ Table.prototype._makeBulk = function _makeBulk () {
 }
 
 Table.prototype.declare = function declare () {
-  const pkey = this.columns.filter(col => col.primary === true).map(col => `[${col.name}]`)
+  const pkey = this.columns.filter(col => col.primary === true).map(col => `[${assertSafeColumnName(col.name)}]`)
   const cols = this.columns.map(col => {
-    const def = [`[${col.name}] ${declareType(col.type, col)}`]
+    const def = [`[${assertSafeColumnName(col.name)}] ${declareType(col.type, col)}`]
 
     if (col.nullable === true) {
       def.push('null')

package/lib/tedious/request.js

@@ -4,7 +4,7 @@ const tds = require('tedious')
 const debug = require('debug')('mssql:tedi')
 const BaseRequest = require('../base/request')
 const RequestError = require('../error/request-error')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, assertSafeColumnName, assertSafeTypeName, assertSafeTypeSize, assertSafeProcedureName } = require('../utils')
 const { TYPES, DECLARATIONS, declare, cast } = require('../datatypes')
 const Table = require('../table')
 const { PARSERS: UDT } = require('../udt')
@@ -12,6 +12,7 @@ const { valueHandler } = require('../shared')
 
 const JSON_COLUMN_ID = 'JSON_F52E2B61-18A1-11d1-B105-00805F49916B'
 const XML_COLUMN_ID = 'XML_F52E2B61-18A1-11d1-B105-00805F49916B'
+const MAX = 65535 // (1 << 16) - 1
 
 const N_TYPES = {
   BitN: 0x68,
@@ -174,6 +175,18 @@ const valueCorrection = function (value, metadata) {
   }
 }
 
+// tedious only compares a length as a number, so `max` is passed as the length it stands
+// for. As a word it compares false against the type's maximum both ways, and tedious then
+// writes a `max` value without its terminator.
+const tediousLength = function (length) {
+  return typeof length === 'string' && length.trim().toLowerCase() === 'max' ? MAX : length
+}
+
+// tedious writes a TVP column with the length it is given, without resolving a missing one,
+// and a missing length fails the same comparisons as `max`. These types are given `max`,
+// which is how tedious wrote them before it compared the length both ways.
+const MAX_LENGTH_TYPES = new Set([tds.TYPES.NVarChar, tds.TYPES.VarChar, tds.TYPES.VarBinary])
+
 const parameterCorrection = function (value) {
   if (value instanceof Table) {
     const tvp = {
@@ -191,7 +204,7 @@ const parameterCorrection = function (value) {
       tvp.columns.push({
         name: col.name,
         type: tediousType,
-        length: col.length,
+        length: col.length == null && MAX_LENGTH_TYPES.has(tediousType) ? MAX : tediousLength(col.length),
         scale: col.scale,
         precision: col.precision
       })
@@ -223,6 +236,15 @@ class Request extends BaseRequest {
 
       try {
         table._makeBulk()
+        // Checked before a connection is borrowed, so that a rejected name cannot leave
+        // the pool short of one.
+        table.columns.forEach(col => assertSafeColumnName(col.name))
+        // tedious writes these into `insert bulk ... WITH (ORDER (<key> <direction>))`
+        // UNQUOTED — unlike a column name, which it emits as `[name]`. So the quoted-identifier
+        // rule does not apply here: what matters is that the key cannot end the clause. It is
+        // checked as an identifier, bare or quoted, which is what that position accepts. The
+        // checked keys are rebuilt into the options actually handed to the driver, so the value
+        // that was validated is the one emitted even if the caller's object changes after.
       } catch (e) {
         return callback(new RequestError(e, 'EREQUEST'))
       }
@@ -340,15 +362,38 @@ class Request extends BaseRequest {
           }
         }
 
-        const bulk = connection.newBulkLoad(table.path, options, done)
+        // A connection is held from here on, so anything that can throw has to hand the
+        // error back through `done`, which releases it. That includes newBulkLoad itself:
+        // tedious validates the bulk options there and throws for a bad `order` direction,
+        // which would otherwise strand the borrowed connection.
+        let bulk
+        let statement
+        try {
+          let bulkOptions = options
+          if (options && options.order) {
+            bulkOptions = Object.assign({}, options, {
+              order: Object.fromEntries(Object.entries(options.order)
+                .map(([key, direction]) => [assertSafeTypeName(key), direction]))
+            })
+          }
+          bulk = connection.newBulkLoad(table.path, bulkOptions, done)
+          for (const col of table.columns) {
+            // tedious emits this name as a quoted identifier of its own when it builds
+            // the `insert bulk` statement, so it is checked here as well as in
+            // Table#declare, in case the name changed since it was checked above.
+            bulk.addColumn(assertSafeColumnName(col.name), getTediousType(col.type), { nullable: col.nullable, length: tediousLength(assertSafeTypeSize(col.length)), scale: assertSafeTypeSize(col.scale), precision: assertSafeTypeSize(col.precision) })
+          }
 
-        for (const col of table.columns) {
-          bulk.addColumn(col.name, getTediousType(col.type), { nullable: col.nullable, length: col.length, scale: col.scale, precision: col.precision })
+          if (table.create) {
+            const objectid = table.temporary ? `tempdb..[${table.name}]` : table.path
+            statement = `if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`
+          }
+        } catch (e) {
+          return done(e)
         }
 
         if (table.create) {
-          const objectid = table.temporary ? `tempdb..[${table.name}]` : table.path
-          const req = new tds.Request(`if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`, err => {
+          const req = new tds.Request(statement, err => {
             if (err) return done(err)
 
             connection.execBulkLoad(bulk, table.rows)
@@ -450,6 +495,26 @@ class Request extends BaseRequest {
         connection.on('errorMessage', errorHandlers.errorMessage = handleError.bind(null, false, connection))
         connection.on('error', errorHandlers.error = handleError.bind(null, true, connection))
 
+        // Give up before the request is sent: the listeners attached just above have to
+        // come off the connection before it goes back to the pool, or they accumulate on
+        // it and fire for whoever borrows it next.
+        const abandon = (err) => {
+          delete this._cancel
+
+          if (hasReturned) {
+            return
+          }
+
+          for (const event in errorHandlers) {
+            connection.removeListener(event, errorHandlers[event])
+          }
+
+          this.parent.release(connection)
+          hasReturned = true
+
+          return callback(err)
+        }
+
         debug('request(%d): query', IDS.get(this), command)
 
         const req = new tds.Request(command, err => {
@@ -666,29 +731,23 @@ class Request extends BaseRequest {
                 param.value = getTediousType(param.type).validate(param.value, this.parent.collation)
               } catch (e) {
                 e.message = `Validation failed for parameter '${name}'. ${e.message}`
-                const err = new RequestError(e, 'EPARAM')
-                delete this._cancel
-
-                if (!hasReturned) {
-                  for (const event in errorHandlers) {
-                    connection.removeListener(event, errorHandlers[event])
-                  }
-
-                  this.parent.release(connection)
-                  hasReturned = true
-                  return callback(err)
-                }
-                return
+                return abandon(new RequestError(e, 'EPARAM'))
               }
             }
 
             const declarations = []
-            for (const name in this.parameters) {
-              if (!objectHasProperty(this.parameters, name)) {
-                continue
+            try {
+              for (const name in this.parameters) {
+                if (!objectHasProperty(this.parameters, name)) {
+                  continue
+                }
+                const param = this.parameters[name]
+                // a connection is held here, so a rejected declaration has to be reported
+                // through the path that releases it
+                declarations.push(`@${name} ${declare(param.type, param)}`)
               }
-              const param = this.parameters[name]
-              declarations.push(`@${name} ${declare(param.type, param)}`)
+            } catch (e) {
+              return abandon(new RequestError(e, 'EREQUEST'))
             }
 
             const assigns = []
@@ -724,14 +783,20 @@ class Request extends BaseRequest {
                 continue
               }
               const param = this.parameters[name]
+              // tedious builds the sp_executesql declaration from these, so a rejected size
+              // has to be reported through the path that releases the connection
               if (param.io === 1) {
-                req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
+                req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: tediousLength(assertSafeTypeSize(param.length)), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
               } else {
-                req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
+                req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: tediousLength(assertSafeTypeSize(param.length)), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
               }
             }
           }
+        } catch (e) {
+          return abandon(new RequestError(e, 'EREQUEST'))
+        }
 
+        try {
           connection[this._isBatch ? 'execSqlBatch' : 'execSql'](req)
         } catch (error) {
           handleError(true, connection, error)
@@ -823,6 +888,35 @@ class Request extends BaseRequest {
         connection.on('errorMessage', errorHandlers.errorMessage = handleError.bind(null, false, connection))
         connection.on('error', errorHandlers.error = handleError.bind(null, true, connection))
 
+        // A connection is held from here on. handleError builds a fresh Error and would
+        // relabel a rejected identifier as EREQUEST, so anything that can throw here is
+        // handed back through this instead, which keeps the code and releases the connection.
+        const abandon = (err) => {
+          delete this._cancel
+
+          if (hasReturned) {
+            return
+          }
+
+          for (const event in errorHandlers) {
+            connection.removeListener(event, errorHandlers[event])
+          }
+
+          this.parent.release(connection)
+          hasReturned = true
+
+          return callback(err)
+        }
+
+        let procedureName
+        try {
+          procedureName = assertSafeProcedureName(procedure)
+        } catch (e) {
+          // wrapped like every other rejection here, so the caller sees the same error class
+          // whichever driver is in use; MSSQLError keeps the EINJECT code through the wrap
+          return abandon(new RequestError(e, 'EREQUEST'))
+        }
+
         if (debug.enabled) {
           // log stored procedure executions and provided parameters
           const params = Object.keys(this.parameters).map(k => this.parameters[k])
@@ -835,7 +929,7 @@ class Request extends BaseRequest {
           debug('request(%d): execute %s %O', IDS.get(this), procedure, logParams)
         }
 
-        const req = new tds.Request(procedure, err => {
+        const req = new tds.Request(procedureName, err => {
           // to make sure we handle no-sql errors as well
           if (err && (!errors.length || (errors.length && err.message !== errors[errors.length - 1].message))) {
             err = new RequestError(err, 'EREQUEST')
@@ -1012,26 +1106,15 @@ class Request extends BaseRequest {
             }
             const param = this.parameters[name]
             if (param.io === 1) {
-              req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
+              req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: tediousLength(assertSafeTypeSize(param.length)), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
             } else {
-              req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
+              req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: tediousLength(assertSafeTypeSize(param.length)), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
             }
           }
 
           connection.callProcedure(req)
         } catch (error) {
-          const err = error instanceof RequestError ? error : new RequestError(error, 'EREQUEST')
-          delete this._cancel
-
-          if (!hasReturned) {
-            for (const event in errorHandlers) {
-              connection.removeListener(event, errorHandlers[event])
-            }
-
-            this.parent.release(connection)
-            hasReturned = true
-            callback(err)
-          }
+          return abandon(error instanceof RequestError ? error : new RequestError(error, 'EREQUEST'))
         }
       })
     })

package/lib/utils.js

@@ -1,5 +1,7 @@
 'use strict'
 
+const MSSQLError = require('./error/mssql-error')
+
 const IDS = new WeakMap()
 const INCREMENT = {
   Connection: 1,
@@ -17,8 +19,94 @@ const getPoolId = (obj) => {
   return parent ? IDS.get(parent) : undefined
 }
 
+// Parameter names are emitted into generated T-SQL as `@<name>`. The `@` occupies the
+// identifier's first position, so every character of the name sits in a subsequent
+// position, where T-SQL also permits digits and `$`. The set is deliberately wider than
+// the names the server will accept: it excludes the characters that could end the
+// identifier and let the rest of the name be read as SQL, and nothing else, so a name
+// the server dislikes still fails there rather than becoming an error here. The
+// exception is the invisible format characters, which are rejected outright.
+// Only the two zero-width joiners are taken from the format characters; the rest of that
+// category includes ZERO WIDTH SPACE, which the server does treat as a separator.
+const PARAM_NAME = /^(?:[\p{L}\p{N}\p{M}\p{Pc}@#$・･]|\u200C|\u200D)*$/u
+// A table-valued parameter's type name is emitted into the parameter declaration, and a
+// stored procedure's name is emitted into an `exec`, so both are checked the way the server
+// reads a qualified name: one or more parts separated by `.`, each either bare, holding only
+// the characters an identifier is made of, or quoted in brackets or double quotes, where
+// anything goes until the closing mark. Nothing that gets through can end the statement it
+// sits in and have the rest read as SQL.
+const QUALIFIED_NAME_PART = '(?:\\[(?:[^\\]]|\\]\\])*\\]|"(?:[^"]|"")*"|[\\p{L}\\p{N}\\p{M}\\p{Pc}@#$]+)'
+// An intermediate part may be omitted — `db..proc` and `server.db..proc` are ordinary
+// T-SQL — but the first and last parts must be present, so a bare `.`, a leading `.proc`
+// and a trailing `db..` are still refused. An empty part cannot end the identifier.
+const QUALIFIED_NAME = new RegExp(`^(?:${QUALIFIED_NAME_PART}(?:\\.${QUALIFIED_NAME_PART}?)*\\.)?${QUALIFIED_NAME_PART}$`, 'u')
+
+// A length, precision or scale is emitted into the same declaration. `max` is the only
+// word the declaration takes there; everything else the server wants is a number.
+const TYPE_SIZE = /^\w*$/
+
+// A column name is emitted as a quoted identifier, `[name]`, by this module and again by
+// the driver's own bulk load. Only `]` can terminate that quoting early, and doubling it
+// is the documented way to include one literally.
+const escapesQuotedIdentifier = (name) => String(name).replace(/]]/g, '').includes(']')
+
 module.exports = {
   objectHasProperty: (object, property) => Object.prototype.hasOwnProperty.call(object, property),
+  isValidParameterName: (name) => {
+    // Only primitives are accepted: an object could return a different value from a second
+    // toString() call, passing validation here and emitting something else into the SQL.
+    const type = typeof name
+    return (type === 'string' || type === 'number') && PARAM_NAME.test(String(name))
+  },
+  assertSafeTypeName: (name) => {
+    // A type name is optional: the tedious driver takes it from the Table passed as the
+    // value, and only uses this one when it is given.
+    if (name == null) {
+      return name
+    }
+    // Read once, and return what was read. Whatever is emitted is what was checked, so a
+    // value that reports a different name the second time cannot reach the SQL.
+    const type = String(name).trim()
+    if (!QUALIFIED_NAME.test(type)) {
+      throw new MSSQLError(`Invalid type name '${type}'. Type names may only contain identifier characters.`, 'EINJECT')
+    }
+    return type
+  },
+  assertSafeProcedureName: (name) => {
+    // The msnodesqlv8 driver builds `exec @___return___ = <name>` as SQL text, so the name is
+    // checked before it is emitted. The tedious driver sends it as a bound RPC and cannot be
+    // injected through it, but it is checked there too so that a name is accepted or rejected
+    // the same way whichever driver is in use.
+    // Read once, and return what was read, for the same reason as the type name.
+    const procedure = String(name).trim()
+    if (!QUALIFIED_NAME.test(procedure)) {
+      throw new MSSQLError(`Invalid procedure name '${procedure}'. Procedure names may only contain identifier characters.`, 'EINJECT')
+    }
+    return procedure
+  },
+  assertSafeTypeSize: (value) => {
+    if (value == null || typeof value === 'number') {
+      return value
+    }
+    // Read once and return what was read, for the same reason as the type name. Padding is
+    // trimmed rather than refused, and a word the server will reject still reaches it.
+    const size = String(value).trim()
+    if (!TYPE_SIZE.test(size)) {
+      throw new MSSQLError(`Invalid type size '${size}'. A length, precision or scale must be a number.`, 'EINJECT')
+    }
+    return size
+  },
+  assertSafeColumnName: (name) => {
+    const type = typeof name
+    if (type !== 'string' && type !== 'number') {
+      throw new MSSQLError(`Invalid column name '${String(name)}'. Column names must be a string or a number.`, 'EINJECT')
+    }
+    const column = String(name)
+    if (escapesQuotedIdentifier(column)) {
+      throw new MSSQLError(`Invalid column name '${column}'. A ']' in a column name must be written as ']]'.`, 'EINJECT')
+    }
+    return column
+  },
   INCREMENT,
   IDS: {
     get: IDS.get.bind(IDS),

package/package.json

@@ -21,7 +21,7 @@
     "azure",
     "node-mssql"
   ],
-  "version": "12.7.1",
+  "version": "12.7.3",
   "main": "index.js",
   "type": "commonjs",
   "repository": {